<!DOCTYPE html>
<html lang="en-US">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width" />
<title>Use our suite of eBPF libraries | Trail of Bits Blog</title>
<link rel="profile" href="http://gmpg.org/xfn/11" />
<link rel="pingback" href="https://blog.trailofbits.com/xmlrpc.php" />
<!--[if lt IE 9]>
<script src="https://blog.trailofbits.com/wp-content/themes/everyday/js/html5.js" type="text/javascript"></script>
<![endif]-->

<meta name='robots' content='max-image-preview:large' />
<!-- Jetpack Site Verification Tags -->
<meta name="google-site-verification" content="Lbyyor8qrpJf-6qi1ql45JDKAmXUIcc3N0mFeVNwUok" />
<link rel='dns-prefetch' href='//js.hs-scripts.com' />
<link rel='dns-prefetch' href='//secure.gravatar.com' />
<link rel='dns-prefetch' href='//stats.wp.com' />
<link rel='dns-prefetch' href='//fonts-api.wp.com' />
<link rel='dns-prefetch' href='//widgets.wp.com' />
<link rel='dns-prefetch' href='//jetpack.wordpress.com' />
<link rel='dns-prefetch' href='//s0.wp.com' />
<link rel='dns-prefetch' href='//public-api.wordpress.com' />
<link rel='dns-prefetch' href='//0.gravatar.com' />
<link rel='dns-prefetch' href='//1.gravatar.com' />
<link rel='dns-prefetch' href='//2.gravatar.com' />
<link rel='dns-prefetch' href='//i0.wp.com' />
<link rel='dns-prefetch' href='//c0.wp.com' />
<link href='https://fonts.gstatic.com' crossorigin rel='preconnect' />
<link rel="alternate" type="application/rss+xml" title="Trail of Bits Blog &raquo; Feed" href="https://blog.trailofbits.com/feed/" />
<link rel="alternate" type="application/rss+xml" title="Trail of Bits Blog &raquo; Comments Feed" href="https://blog.trailofbits.com/comments/feed/" />
<link rel="alternate" type="application/rss+xml" title="Trail of Bits Blog &raquo; Use our suite of eBPF libraries Comments Feed" href="https://blog.trailofbits.com/2023/08/09/use-our-suite-of-ebpf-libraries/feed/" />
<script type="text/javascript">
window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/blog.trailofbits.com\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.3"}};
/*! This file is auto-generated */
!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0),new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data));return t.every(function(e,t){return e===r[t]})}function u(e,t,n){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\uddfa\ud83c\uddf3","\ud83c\uddfa\u200b\ud83c\uddf3")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!n(e,"\ud83e\udef1\ud83c\udffb\u200d\ud83e\udef2\ud83c\udfff","\ud83e\udef1\ud83c\udffb\u200b\ud83e\udef2\ud83c\udfff")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(s),u.toString(),p.toString()].join(",")+"));",r=new Blob([e],{type:"text/javascript"}),a=new Worker(URL.createObjectURL(r),{name:"wpTestEmojiSupports"});return void(a.onmessage=function(e){c(n=e.data),a.terminate(),t(n)})}catch(e){}c(n=f(s,u,p))}t(n)}).then(function(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything||(n.readyCallback(),(e=n.source||{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);
</script>
<style type="text/css">
img.wp-smiley,
img.emoji {
	display: inline !important;
	border: none !important;
	box-shadow: none !important;
	height: 1em !important;
	width: 1em !important;
	margin: 0 0.07em !important;
	vertical-align: -0.1em !important;
	background: none !important;
	padding: 0 !important;
}
</style>
	<link rel='stylesheet' id='all-css-eb71997771846b96f61ea77e8090d491' href='https://blog.trailofbits.com/_static/??-eJyNUstyAiEQ/KHgxENMckjlYlU+wA+wWJhClFcxg5v9+7DrbkrXqLkADT1Nz6NNQsXAGBiSK8YGgj1ykuoAPurikCCjk4xapEg8QwtF9NReS5hSYYPZQFOs09C4qA7C2SbL3AFx5/BWqJNdLCxMtvo+cbI57tsjBh0zyMLRS2arphdxtBpjykh0YQe15RowAIKBVFdspw9tUK7oWoA9ga9kiQ597+AcpOoXs3BopOoW3oaH0fXtHJ/HTCn6IqYs26Sipx1cZ8f4zScl0VptkMVQLoIqBuNNz/lvj+o/KYbKoPt1V3Gs2G+Ga0zVHQZlK/iKa6l1B5uTmZN2PzJ008l84Jw94A0TvKtFI8Aj5k7LB6M016WdzKgHd/3RBvMocltzBIrKSidcNJEuwF+tmyv0zRjPPfXTfyxX78vVy+r1+e0HqPpWyw==' type='text/css' media='all' />
<style id='wp-block-library-inline-css'>
.has-text-align-justify{text-align:justify;}
</style>
<style id='classic-theme-styles-inline-css'>
/*! This file is auto-generated */
.wp-block-button__link{color:#fff;background-color:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}
</style>
<style id='global-styles-inline-css'>
body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--font-family--albert-sans: 'Albert Sans';--wp--preset--font-family--alegreya: Alegreya;--wp--preset--font-family--arvo: Arvo;--wp--preset--font-family--bodoni-moda: 'Bodoni Moda';--wp--preset--font-family--cabin: Cabin;--wp--preset--font-family--chivo: Chivo;--wp--preset--font-family--commissioner: Commissioner;--wp--preset--font-family--cormorant: Cormorant;--wp--preset--font-family--courier-prime: 'Courier Prime';--wp--preset--font-family--crimson-pro: 'Crimson Pro';--wp--preset--font-family--dm-mono: 'DM Mono';--wp--preset--font-family--dm-sans: 'DM Sans';--wp--preset--font-family--domine: Domine;--wp--preset--font-family--eb-garamond: 'EB Garamond';--wp--preset--font-family--epilogue: Epilogue;--wp--preset--font-family--figtree: Figtree;--wp--preset--font-family--fira-sans: 'Fira Sans';--wp--preset--font-family--fraunces: Fraunces;--wp--preset--font-family--ibm-plex-mono: 'IBM Plex Mono';--wp--preset--font-family--ibm-plex-sans: 'IBM Plex Sans';--wp--preset--font-family--inter: Inter;--wp--preset--font-family--josefin-sans: 'Josefin Sans';--wp--preset--font-family--jost: Jost;--wp--preset--font-family--libre-baskerville: 'Libre Baskerville';--wp--preset--font-family--libre-franklin: 'Libre Franklin';--wp--preset--font-family--literata: Literata;--wp--preset--font-family--lora: Lora;--wp--preset--font-family--merriweather: Merriweather;--wp--preset--font-family--montserrat: Montserrat;--wp--preset--font-family--newsreader: Newsreader;--wp--preset--font-family--nunito: Nunito;--wp--preset--font-family--open-sans: 'Open Sans';--wp--preset--font-family--overpass: Overpass;--wp--preset--font-family--petrona: Petrona;--wp--preset--font-family--piazzolla: Piazzolla;--wp--preset--font-family--playfair-display: 'Playfair Display';--wp--preset--font-family--plus-jakarta-sans: 'Plus Jakarta Sans';--wp--preset--font-family--poppins: Poppins;--wp--preset--font-family--raleway: Raleway;--wp--preset--font-family--roboto-slab: 'Roboto Slab';--wp--preset--font-family--roboto: Roboto;--wp--preset--font-family--rubik: Rubik;--wp--preset--font-family--sora: Sora;--wp--preset--font-family--source-sans-pro: 'Source Sans Pro';--wp--preset--font-family--source-serif-pro: 'Source Serif Pro';--wp--preset--font-family--space-mono: 'Space Mono';--wp--preset--font-family--texturina: Texturina;--wp--preset--font-family--work-sans: 'Work Sans';--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3px rgba(255, 255, 255, 1), 6px 6px rgba(0, 0, 0, 1);--wp--preset--shadow--crisp: 6px 6px 0px rgba(0, 0, 0, 1);}:where(.is-layout-flex){gap: 0.5em;}:where(.is-layout-grid){gap: 0.5em;}body .is-layout-flow > .alignleft{float: left;margin-inline-start: 0;margin-inline-end: 2em;}body .is-layout-flow > .alignright{float: right;margin-inline-start: 2em;margin-inline-end: 0;}body .is-layout-flow > .aligncenter{margin-left: auto !important;margin-right: auto !important;}body .is-layout-constrained > .alignleft{float: left;margin-inline-start: 0;margin-inline-end: 2em;}body .is-layout-constrained > .alignright{float: right;margin-inline-start: 2em;margin-inline-end: 0;}body .is-layout-constrained > .aligncenter{margin-left: auto !important;margin-right: auto !important;}body .is-layout-constrained > :where(:not(.alignleft):not(.alignright):not(.alignfull)){max-width: var(--wp--style--global--content-size);margin-left: auto !important;margin-right: auto !important;}body .is-layout-constrained > .alignwide{max-width: var(--wp--style--global--wide-size);}body .is-layout-flex{display: flex;}body .is-layout-flex{flex-wrap: wrap;align-items: center;}body .is-layout-flex > *{margin: 0;}body .is-layout-grid{display: grid;}body .is-layout-grid > *{margin: 0;}:where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;}
:where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}
.wp-block-pullquote{font-size: 1.5em;line-height: 1.6;}
.wp-block-navigation a:where(:not(.wp-element-button)){color: inherit;}
:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}
</style>
<link rel='stylesheet' id='dashicons-css' href='https://blog.trailofbits.com/wp-includes/css/dashicons.min.css?ver=6.3' media='all' />
<link rel='stylesheet' id='everyday-droid-serif-css' href='https://fonts-api.wp.com/css?family=Droid+Serif%3A400%2C700%2C400italic%2C700italic&#038;ver=20120328' media='all' />
<link rel='stylesheet' id='everyday-droid-sans-css' href='https://fonts-api.wp.com/css?family=Droid+Sans%3A400%2C700&#038;ver=20120328' media='all' />
<link rel='stylesheet' id='everyday-droid-mono-css' href='https://fonts-api.wp.com/css?family=Droid+Sans+Mono&#038;ver=20120328' media='all' />
<style id='jetpack-global-styles-frontend-style-inline-css'>
:root { --font-headings: unset; --font-base: unset; --font-headings-default: -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif; --font-base-default: -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif;}
</style>
<script id='jetpack_related-posts-js-extra'>
var related_posts_js_options = {"post_heading":"h4"};
</script>
<script type='text/javascript'  src='https://blog.trailofbits.com/wp-content/plugins/jetpack/_inc/build/related-posts/related-posts.min.js?m=1687202188'></script>
<script src='https://blog.trailofbits.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.0' id='jquery-core-js'></script>
<script type='text/javascript'  src='https://blog.trailofbits.com/wp-includes/js/jquery/jquery-migrate.min.js?m=1686289764'></script>
<link rel="https://api.w.org/" href="https://blog.trailofbits.com/wp-json/" /><link rel="alternate" type="application/json" href="https://blog.trailofbits.com/wp-json/wp/v2/posts/104838" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://blog.trailofbits.com/xmlrpc.php?rsd" />

<link rel="canonical" href="https://blog.trailofbits.com/2023/08/09/use-our-suite-of-ebpf-libraries/" />
<link rel='shortlink' href='https://blog.trailofbits.com/?p=104838' />
<link rel="alternate" type="application/json+oembed" href="https://blog.trailofbits.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fblog.trailofbits.com%2F2023%2F08%2F09%2Fuse-our-suite-of-ebpf-libraries%2F" />
<link rel="alternate" type="text/xml+oembed" href="https://blog.trailofbits.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fblog.trailofbits.com%2F2023%2F08%2F09%2Fuse-our-suite-of-ebpf-libraries%2F&#038;format=xml" />
			<!-- DO NOT COPY THIS SNIPPET! Start of Page Analytics Tracking for HubSpot WordPress plugin v10.1.30-->
			<script type="text/javascript" class="hsq-set-content-id" data-content-id="blog-post">
				var _hsq = _hsq || [];
				_hsq.push(["setContentType", "blog-post"]);
			</script>
			<!-- DO NOT COPY THIS SNIPPET! End of Page Analytics Tracking for HubSpot WordPress plugin -->
				<style>img#wpstats{display:none}</style>
		<style>
#page {
	background-color: #f7f7f7;
}
</style>

<meta name="description" content="By Artem Dinaburg Trail of Bits has developed a suite of open-source libraries designed to streamline the creation and deployment of eBPF applications. These libraries facilitate efficient process and network event monitoring, function tracing, kernel debug symbol parsing, and eBPF code generation. Previously, deploying portable, dependency-free eBPF applications posed significant challenges due to Linux kernel&hellip;" />
<style type="text/css" id="custom-background-css">
body.custom-background { background-image: url("https://blog.trailofbits.com/wp-content/themes/everyday/images/background.png"); background-position: left top; background-size: auto; background-repeat: repeat; background-attachment: scroll; }
</style>
				<style type="text/css">
				/* If html does not have either class, do not show lazy loaded images. */
				html:not( .jetpack-lazy-images-js-enabled ):not( .js ) .jetpack-lazy-image {
					display: none;
				}
			</style>
			<script>
				document.documentElement.classList.add(
					'jetpack-lazy-images-js-enabled'
				);
			</script>
		
<!-- Jetpack Open Graph Tags -->
<meta property="og:type" content="article" />
<meta property="og:title" content="Use our suite of eBPF libraries" />
<meta property="og:url" content="https://blog.trailofbits.com/2023/08/09/use-our-suite-of-ebpf-libraries/" />
<meta property="og:description" content="By Artem Dinaburg Trail of Bits has developed a suite of open-source libraries designed to streamline the creation and deployment of eBPF applications. These libraries facilitate efficient process …" />
<meta property="article:published_time" content="2023-08-09T10:45:15+00:00" />
<meta property="article:modified_time" content="2023-08-08T20:27:35+00:00" />
<meta property="og:site_name" content="Trail of Bits Blog" />
<meta property="og:image" content="https://videos.files.wordpress.com/C7KAG0EK/linuxevents_execsnoop_mp4_hd.original.jpg" />
<meta property="og:image:secure_url" content="https://videos.files.wordpress.com/C7KAG0EK/linuxevents_execsnoop_mp4_hd.original.jpg" />
<meta property="og:image:width" content="512" />
<meta property="og:image:height" content="512" />
<meta property="og:image:alt" content="" />
<meta property="og:locale" content="en_US" />
<meta name="twitter:creator" content="@trailofbits" />
<meta name="twitter:site" content="@trailofbits" />
<meta name="twitter:text:title" content="Use our suite of eBPF libraries" />
<meta name="twitter:image" content="https://i0.wp.com/blog.trailofbits.com/wp-content/uploads/2020/07/cropped-android-chrome-512x512-1.png?fit=240%2C240&amp;ssl=1" />
<meta name="twitter:card" content="summary" />

<!-- End Jetpack Open Graph Tags -->
<link rel="icon" href="https://i0.wp.com/blog.trailofbits.com/wp-content/uploads/2020/07/cropped-android-chrome-512x512-1.png?fit=32%2C32&#038;ssl=1" sizes="32x32" />
<link rel="icon" href="https://i0.wp.com/blog.trailofbits.com/wp-content/uploads/2020/07/cropped-android-chrome-512x512-1.png?fit=192%2C192&#038;ssl=1" sizes="192x192" />
<link rel="apple-touch-icon" href="https://i0.wp.com/blog.trailofbits.com/wp-content/uploads/2020/07/cropped-android-chrome-512x512-1.png?fit=180%2C180&#038;ssl=1" />
<meta name="msapplication-TileImage" content="https://i0.wp.com/blog.trailofbits.com/wp-content/uploads/2020/07/cropped-android-chrome-512x512-1.png?fit=270%2C270&#038;ssl=1" />
<style type="text/css" id="wp-custom-css">/*
Welcome to Custom CSS!

To learn how this works, see http://wp.me/PEmnE-Bt
*/
.entry-content {
	padding-left: 0;
}

.entry-content
blockquote {
	margin-left: 25px;
}

.entry-content
.embed {
	margin-left: 0;
}

.entry-content
.embed-youtube {
	margin-left: 0;
}

/* To remove the infinite scroll footer HC-23308875-SK */
#infinite-footer
{
  display:none;
}

.wp-caption 
.wp-caption-text {
	text-align: center;
}

@media only screen and ( max-width: 600px ) {
    body {
        margin: 0;
        padding: 10px;
        overflow: auto;
        width: 100%
    }
}</style><!-- Your Google Analytics Plugin is missing the tracking ID -->
</head>

<body class="post-template-default single single-post postid-104838 single-format-standard custom-background group-blog">
<div id="page" class="hfeed site">
		<header id="masthead" class="site-header" role="banner">
		<hgroup>
			<h1 class="site-title"><a href="https://blog.trailofbits.com/" title="Trail of Bits Blog" rel="home">Trail of Bits Blog</a></h1>
			<h2 class="site-description"></h2>
					</hgroup>

		<nav role="navigation" class="site-navigation main-navigation">
			<h1 class="assistive-text">Menu</h1>
			<div class="assistive-text skip-link"><a href="#content" title="Skip to content">Skip to content</a></div>
			<div class="menu"><ul>
<li ><a href="https://blog.trailofbits.com/">Home</a></li></ul></div>
		</nav>
	</header><!-- #masthead .site-header -->

	<div id="main" class="main">
		<div id="primary" class="site-content">
			<div id="content" role="main">

			
				
<article id="post-104838" class="post-104838 post type-post status-publish format-standard hentry category-uncategorized entry">
	<header class="entry-header">

		<h1 class="entry-title">Use our suite of eBPF libraries</h1>
					<ul class="entry-meta">
				<li class="entry-format">Post</li>
				<li class="permalink"><a href="https://blog.trailofbits.com/2023/08/09/use-our-suite-of-ebpf-libraries/" title="6:45 am" rel="bookmark"><time class="entry-date" datetime="2023-08-09T06:45:15-04:00" pubdate>August 9, 2023</time></a></li>
				<li class="comment-link"><a href="https://blog.trailofbits.com/2023/08/09/use-our-suite-of-ebpf-libraries/#respond">Leave a comment</a></li>
							</ul><!-- .entry-meta -->
			</header><!-- .entry-header -->

	<div class="entry-content">
		<p><strong><em>By Artem Dinaburg</em></strong></p>
<p>Trail of Bits has developed a suite of open-source libraries designed to streamline the creation and deployment of eBPF applications. These libraries facilitate efficient process and network event monitoring, function tracing, kernel debug symbol parsing, and eBPF code generation.</p>
<p>Previously, deploying portable, dependency-free eBPF applications posed significant challenges due to Linux kernel version disparities and the need for external tools for C-to-eBPF bytecode translation. We’ve addressed these issues with our innovative libraries, which use the latest eBPF and Linux kernel features to reduce external dependencies. These tools, ideal for creating on-machine agents and enabling cloud-native monitoring, are actively maintained and compatible with a variety of Linux distributions and kernel releases. Some are even integral to the functionality of <a href="https://www.osquery.io/" rel="noopener" target="_blank">osquery</a>, the renowned endpoint visibility framework.</p>
<h2>Our eBPF libraries</h2>
<p>The libraries in this suite are <code>linuxevents</code>, <code>ebpfpub</code>, <code>btfparse</code>, and <code>ebpf-common</code>. Together they can be used to develop streamlined event monitoring with a high degree of accuracy and efficiency. Their applications range from network event monitoring, function tracing, and kernel debug symbol parsing to assisting in generating and using eBPF code.</p>
<h3>linuxevents: A container-aware library for process monitoring with no runtime dependencies</h3>
<p>The <code><a href="https://github.com/trailofbits/linuxevents/tree/main" rel="noopener" target="_blank">linuxevents</a></code> library showcases how eBPF can monitor events <strong>without requiring accurate kernel headers or other external dependencies</strong>. No more shipping kernel headers, multiple copies of precompiled eBPF bytecode, or dependencies on BCC! The <code>linuxevents</code> library supports runtime code generation to create custom probes at runtime, not just during build. It is also much faster than traditional system-call-based hooking, an essential feature when monitoring events from multiple containers on a single machine. How does <code>linuxevents</code> do this?</p>
<p>First, <code>linuxevents</code> uses the Linux kernel’s <a href="https://docs.kernel.org/bpf/btf.html" rel="noopener" target="_blank">BTF debugging data</a> (via our <code><a href="https://github.com/trailofbits/btfparse" rel="noopener" target="_blank">btfparse</a></code> library) to accurately identify function prototypes and kernel data structures. This allows <code>linuxevents</code> to automatically adjust to variances in data structure layout and to hook arbitrary non-public symbols in a way that greatly simplifies tracing.</p>
<p>This approach is faster than traditional system call based hooking not only because it has to hook fewer things (<code>sched_process_exec</code> vs <code>execve</code>, <code>execveat</code>, etc.) but also because it can avoid expensive correlations. For example, to trace which program on disk is executed via <code>execve</code>, one would normally have to correlate a file descriptor passed to <code>execve</code> with an open call and multiple <code>chdir</code> calls to get the full path of a program. The correlation is computationally expensive, especially on a machine with multiple active containers. The <code>linuxevents</code> library uses an accurate kernel data structure representation to hook just one function and simply <a href="https://github.com/trailofbits/linuxevents/blob/a0a7e5aee09da1388354bc7ce459622d68a602e7/linuxevents/bpf/src/sched_process_exec.c#L44" rel="noopener" target="_blank">extract the path from the kernel’s vfs layer</a>.</p>
<div style="margin-bottom:-15px">
<div id="v-C7KAG0EK-1" class="video-player"><iframe title='VideoPress Video Player' aria-label='VideoPress Video Player' width='690' height='528' src='https://videopress.com/embed/C7KAG0EK?hd=1&amp;cover=1&amp;loop=0&amp;autoPlay=0&amp;permalink=1&amp;muted=0&amp;controls=1&amp;playsinline=0&amp;useAverageColor=0&amp;preloadContent=metadata' frameborder='0' allowfullscreen data-resize-to-parent="true" allow='clipboard-write'></iframe><script src='https://s0.wp.com/wp-content/plugins/video/assets/js/next/videopress-iframe.js'></script></div>
</div>
<p class="wp-caption-text">A recording of the linuxevents library being used as a part of the execsnoop example that comes with the library</p>
<p>The <code>linuxevents</code> library is still a proof of concept; it is in use by osquery as a <a href="https://github.com/osquery/osquery/blob/01b8587d01d46bd1fbfe9959837306644aac5484/osquery/experimental/experiments/linuxevents/README.md?plain=1#L1" rel="noopener" target="_blank">toggleable experiment</a>. The library also has a canonical example of <a href="https://github.com/trailofbits/linuxevents/blob/main/examples/execsnoop/src/main.cpp" rel="noopener" target="_blank">tracing executed processes with cross-container visibility</a>.</p>
<h3>ebpfpub: A function-tracing library for Linux</h3>
<p>The <code><a href="https://github.com/trailofbits/ebpfpub" rel="noopener" target="_blank">ebpfpub</a></code> library allows for monitoring system calls across multiple Linux kernel versions while relying on minimal external runtime dependencies. In <code>ebpfpub</code>, eBPF probes are autogenerated from function prototypes defined via <a href="https://github.com/trailofbits/ebpfpub/blob/86bb378dd470cbeb0a3e123181df66dccae6c857/ebpfpub/src/tracepointserializers.cpp#L27" rel="noopener" target="_blank">a simple custom language</a>, which can be created from tracepoint descriptors. This approach required proper headers for the running kernel and it came with performance penalties, such as the need to match file descriptors with system calls.</p>
<p>Depending on the desired target event, <code>ebpfpub</code> can use either kernel <a href="https://docs.kernel.org/trace/tracepoints.html" rel="noopener" target="_blank">tracepoints</a>, <a href="https://docs.kernel.org/trace/kprobes.html" rel="noopener" target="_blank">kprobes</a>, or <a href="https://www.kernel.org/doc/html/next/trace/uprobetracer.html" rel="noopener" target="_blank">uprobes</a> as the underlying tracing mechanism. The library includes the following examples:</p>
<ul>
<li><code><a href="https://github.com/trailofbits/ebpfpub/blob/main/examples/execsnoop/src/main.cpp" rel="noopener" target="_blank">execsnoop</a></code>: Shows how to use Linux kernel tracepoints to detect program execution via <code>execve()</code></li>
<li><code><a href="https://github.com/trailofbits/ebpfpub/blob/main/examples/kprobe_execsnoop/src/main.cpp" rel="noopener" target="_blank">kprobe_execsnoop</a></code>: Like <code>execsnoop</code>, but uses a different hooking mechanism (kprobes instead of tracepoints)</li>
<li><code><a href="https://github.com/trailofbits/ebpfpub/blob/main/examples/readline_trace/src/main.cpp" rel="noopener" target="_blank">readline_trace</a></code>: Uses uprobes to hook the user-mode readline library, which can enable use cases such as monitoring whenever a live shell is used on a machine</li>
<li><code><a href="https://github.com/trailofbits/ebpfpub/blob/main/examples/socketevents/src/main.cpp" rel="noopener" target="_blank">sockevents</a></code>: An example of how to trace sockets through a series of connect/accept/bind calls that establish connectivity to a remote machine</li>
<li><code><a href="https://github.com/trailofbits/ebpfpub/blob/main/examples/systemd_resolved/src/main.cpp" rel="noopener" target="_blank">systemd_resolved</a></code>: Shows how to use uprobes to hook into systemd’s DNS service (systemd-resolved), which will show in real time the domains being looked up by your local machine</li>
</ul>
<p>The <code>ebpfpub</code> library is currently used by osquery to capture process and socket events by tracing executed system calls. While <code>ebpfpub</code> is still maintained and useful in specific circumstances (like the need to support older kernels and use runtime code generation), new projects should use the <code>linuxevents</code> approach instead.</p>
<h3>btfparse: A C++ library that parses kernel debug symbols in BTF format</h3>
<p>BTF, or the Binary Type Format, is a compact binary format for representing type information in the Linux kernel. BTF stores data such as structures, unions, enumerations, and typedefs.  Debuggers and other tools can use BTF data to enable richer debugging features by understanding complex C types and expressions. BTF was introduced in Linux 4.20 and is generated from source code and traditional debugging information like DWARF. BTF is more compact than DWARF, and it improves the debugging experience by conveying more semantic type information than was previously available. The standardized BTF format also allows new debugging tools to leverage type data across compilers, enabling more consistent quality of introspection across languages.</p>
<p>The <code><a href="https://github.com/trailofbits/btfparse" rel="noopener" target="_blank">btfparse</a></code> library allows you to read BTF data in your C++ projects and generate header files directly in memory without any external application. The library also comes with a tool, called <code><a href="https://github.com/trailofbits/btfparse#tool-example-dump-btf" rel="noopener" target="_blank">btf-dump</a></code>, that serves both as an example of using <code>btfparse</code> and as a standalone tool that can dump BTF data present in a Linux kernel image.</p>
<h3>ebpf-common: A C++ library to help write new eBPF-based tools</h3>
<p>The <code><a href="https://github.com/trailofbits/ebpf-common" rel="noopener" target="_blank">ebpf-common</a></code> library is a set of utilities that assist with generating, loading, and using eBPF code. It is the common substrate that underpins all of our eBPF-related tooling. Use <code>epbf-common</code> to create your own runtime, eBPF-based tools!</p>
<p>The <code>ebpf-common</code> library’s main job is to compile C code to eBPF bytecode and to provide helpful abstractions that make writing eBPF hooks easier. Here are some of the features <code>ebpf-common</code> provides:</p>
<ul>
<li>It uses LLVM and clang as libraries that write to in-memory scratch buffers.</li>
<li>It includes abstractions to make accessing eBPF data structures (hash maps, arrays, ring buffers, etc.) simple. These data structures are used to exchange data between eBPF and your application.</li>
<li>It includes abstractions to create and read perf outputs, another way eBPF can communicate with the tracing application.</li>
<li>It allows for the management of events (like kprobes, uprobes, and tracepoints) that trigger the execution of eBPF programs.</li>
<li>Finally, it includes functions that implement eBPF <a href="https://man7.org/linux/man-pages/man7/bpf-helpers.7.html" rel="noopener" target="_blank">helpers</a> and related functionality via LLVM.</li>
</ul>
<p>The <code>ebpf-common</code> library is used as the core of all of our other eBPF tools, which serve as library clients and examples of use cases for <code>ebpf-common</code> for your applications. Refer to our blog post <a href="https://blog.trailofbits.com/2021/11/09/all-your-tracing-are-belong-to-bpf/" rel="noopener" target="_blank">All your tracing are belong to BPF</a> for additional guidance and examples for how to use <code>ebpf-common</code>.</p>
<h2>Our eBPF tools</h2>
<h3>ebpfault: A Linux system call fault injector built on top of eBPF</h3>
<p><code><a href="https://github.com/trailofbits/ebpfault" rel="noopener" target="_blank">ebpfault</a></code> is a system-wide fault injector that does not require risky kernel drivers that could crash the system. It can start a specific program, target running processes, or target all processes <em>except</em> those on a specific list. A simple configuration file in JSON format lets you configure faults by using the syscall name, the probability of injecting a fault, and the error code that should be returned.</p>
<div style="margin-bottom:-15px">
<div id="v-ab5I1ePa-1" class="video-player"><iframe title='VideoPress Video Player' aria-label='VideoPress Video Player' width='690' height='406' src='https://videopress.com/embed/ab5I1ePa?hd=1&amp;cover=1&amp;loop=0&amp;autoPlay=0&amp;permalink=1&amp;muted=0&amp;controls=1&amp;playsinline=0&amp;useAverageColor=0&amp;preloadContent=metadata' frameborder='0' allowfullscreen data-resize-to-parent="true" allow='clipboard-write'></iframe><script src='https://s0.wp.com/wp-content/plugins/video/assets/js/next/videopress-iframe.js'></script></div>
</div>
<div style="margin-bottom:-15px">
<div id="v-qWiXnuzh-1" class="video-player"><iframe title='VideoPress Video Player' aria-label='VideoPress Video Player' width='690' height='406' src='https://videopress.com/embed/qWiXnuzh?hd=1&amp;cover=1&amp;loop=0&amp;autoPlay=0&amp;permalink=1&amp;muted=0&amp;controls=1&amp;playsinline=0&amp;useAverageColor=0&amp;preloadContent=metadata' frameborder='0' allowfullscreen data-resize-to-parent="true" allow='clipboard-write'></iframe><script src='https://s0.wp.com/wp-content/plugins/video/assets/js/next/videopress-iframe.js'></script></div>
</div>
<p class="wp-caption-text">
A recording of ebpfault running against the htop process and causing faults via a specific configuration</p>
<h2>BPF deep-dives and talks</h2>
<p>Most of the material available online is geared toward using the command-line sample tools  that demonstrate eBPF, which work mostly as standalone demonstrations and not as reusable libraries. We wanted to fill in the gaps for developers and provide a step-by-step guide on how to actually integrate eBPF from scratch from the point of view of a developer writing a tracing tool. The documentation focuses on runtime code generation using the LLVM libraries.</p>
<p>The <strong><a href="https://blog.trailofbits.com/2021/11/09/all-your-tracing-are-belong-to-bpf/" rel="noopener" target="_blank">All your tracing belong to BPF</a></strong> blog post and our <a href="https://github.com/trailofbits/bpf_tutorials_code" rel="noopener" target="_blank">companion code guide</a> show how to use <code>epbf-common</code> to create a tool that uses eBPF to count system calls, with each example increasing in complexity, starting from simple counting, to using maps to store data, to finally using perf events for outputs.</p>
<p><strong><a href="https://www.youtube.com/watch?v=9ufYYq5HH_0" rel="noopener" target="_blank">Monitoring Linux events</a></strong> is a talk by Alessandro Gario about using eBPF for event monitoring. Alessandro describes how to dynamically decide on what to monitor and to generate your own eBPF bytecode directly from C++. He touches on some of the intricacies of eBPF maps, perf events, and practical considerations for using our eBPF tools and libraries.</p>
<h2>eBPF public contributions</h2>
<p>The world of eBPF continues to expand and find applications in various domains. We have explored eBPF as it relates to interesting tasks beyond tracing and performance monitoring, such as improving CI/CD for eBPF bytecode, writing an eBPF-to-ARM64 JIT compiler for the Solana platform, and improving the experience of building eBPF projects on Windows.</p>
<p><strong><code><a href="https://blog.trailofbits.com/2023/01/19/ebpf-verifier-harness/" rel="noopener" target="_blank">ebpf-verifier</a></code></strong>: Sometimes it is necessary to bundle prebuilt eBPF programs. The Linux kernel “verifies” eBPF programs at load time and rejects any that it deems unsafe. Bundling eBPF bytecode is a CI/CD nightmare because every kernel’s verification is ever so slightly different. <code>ebpf-verifier</code> aims to eliminate that nightmare by executing the eBPF verifier outside of the running kernel and opens the door to the possibility of testing eBPF programs across different kernel versions.</p>
<p><strong><a href="https://blog.trailofbits.com/2022/10/12/solana-jit-compiler-ebpf-arm64/" rel="noopener" target="_blank">Solana eBPF-to-ARM64 JIT compiler</a></strong>: eBPF makes an appearance in many surprising places! The Solana blockchain uses an eBPF virtual machine to run its smart contracts, and it uses a JIT compiler to compile the eBPF bytecode to native architectures. Trail of Bits ported the Solana eBPF JIT compiler to ARM64 to allow Solana applications to natively run on the now very popular ARM64 platforms like Apple Silicon.</p>
<p><strong><a href="https://github.com/microsoft/ebpf-for-windows/pull/882" rel="noopener" target="_blank">Adding CMake support to eBPF for Windows</a></strong>: eBPF also works on Windows! To make Windows development easier, we ported the prior Visual Studio–based build system to CMake. The improvements include better handling of transitive dependencies and properties, better packaging, and enhanced build settings for a more efficient development experience.</p>
<h2>Conclusion</h2>
<p>We’ve used eBPF to provide rapid, high-quality monitoring data for system instrumentation agents like osquery. Our intention is that the frameworks and tools we’ve created will assist developers in integrating eBPF into their applications more seamlessly. eBPF is a useful technology with a bright future in a variety of fields, including increasingly in cloud-native monitoring and observation.</p>
<p>We plan to share more of our lessons learned from eBPF tool development in the near future, and we hope to apply some of these lessons to the problems of cloud-native monitoring and observability.</p>
<div class="sharedaddy sd-sharing-enabled"><div class="robots-nocontent sd-block sd-social sd-social-icon-text sd-sharing"><h3 class="sd-title">Share this:</h3><div class="sd-content"><ul><li class="share-twitter"><a rel="nofollow noopener noreferrer" data-shared="sharing-twitter-104838" class="share-twitter sd-button share-icon" href="https://blog.trailofbits.com/2023/08/09/use-our-suite-of-ebpf-libraries/?share=twitter" target="_blank" title="Click to share on Twitter" ><span>Twitter</span></a></li><li class="share-linkedin"><a rel="nofollow noopener noreferrer" data-shared="sharing-linkedin-104838" class="share-linkedin sd-button share-icon" href="https://blog.trailofbits.com/2023/08/09/use-our-suite-of-ebpf-libraries/?share=linkedin" target="_blank" title="Click to share on LinkedIn" ><span>LinkedIn</span></a></li><li class="share-reddit"><a rel="nofollow noopener noreferrer" data-shared="" class="share-reddit sd-button share-icon" href="https://blog.trailofbits.com/2023/08/09/use-our-suite-of-ebpf-libraries/?share=reddit" target="_blank" title="Click to share on Reddit" ><span>Reddit</span></a></li><li class="share-telegram"><a rel="nofollow noopener noreferrer" data-shared="" class="share-telegram sd-button share-icon" href="https://blog.trailofbits.com/2023/08/09/use-our-suite-of-ebpf-libraries/?share=telegram" target="_blank" title="Click to share on Telegram" ><span>Telegram</span></a></li><li class="share-facebook"><a rel="nofollow noopener noreferrer" data-shared="sharing-facebook-104838" class="share-facebook sd-button share-icon" href="https://blog.trailofbits.com/2023/08/09/use-our-suite-of-ebpf-libraries/?share=facebook" target="_blank" title="Click to share on Facebook" ><span>Facebook</span></a></li><li class="share-pocket"><a rel="nofollow noopener noreferrer" data-shared="" class="share-pocket sd-button share-icon" href="https://blog.trailofbits.com/2023/08/09/use-our-suite-of-ebpf-libraries/?share=pocket" target="_blank" title="Click to share on Pocket" ><span>Pocket</span></a></li><li class="share-email"><a rel="nofollow noopener noreferrer" data-shared="" class="share-email sd-button share-icon" href="mailto:?subject=%5BShared%20Post%5D%20Use%20our%20suite%20of%20eBPF%20libraries&body=https%3A%2F%2Fblog.trailofbits.com%2F2023%2F08%2F09%2Fuse-our-suite-of-ebpf-libraries%2F&share=email" target="_blank" title="Click to email a link to a friend" data-email-share-error-title="Do you have email set up?" data-email-share-error-text="If you&#039;re having problems sharing via email, you might not have email set up for your browser. You may need to create a new email yourself." data-email-share-nonce="1743cfbcd0" data-email-share-track-url="https://blog.trailofbits.com/2023/08/09/use-our-suite-of-ebpf-libraries/?share=email"><span>Email</span></a></li><li class="share-print"><a rel="nofollow noopener noreferrer" data-shared="" class="share-print sd-button share-icon" href="https://blog.trailofbits.com/2023/08/09/use-our-suite-of-ebpf-libraries/#print" target="_blank" title="Click to print" ><span>Print</span></a></li><li class="share-end"></li></ul></div></div></div><div class='sharedaddy sd-block sd-like jetpack-likes-widget-wrapper jetpack-likes-widget-unloaded' id='like-post-wrapper-3681601-104838-64d793ac70b6f' data-src='https://widgets.wp.com/likes/#blog_id=3681601&amp;post_id=104838&amp;origin=blog.trailofbits.com&amp;obj_id=3681601-104838-64d793ac70b6f' data-name='like-post-frame-3681601-104838-64d793ac70b6f' data-title='Like or Reblog'><h3 class="sd-title">Like this:</h3><div class='likes-widget-placeholder post-likes-widget-placeholder' style='height: 55px;'><span class='button'><span>Like</span></span> <span class="loading">Loading...</span></div><span class='sd-text-color'></span><a class='sd-link-color'></a></div>
<div id='jp-relatedposts' class='jp-relatedposts' >
	<h3 class="jp-relatedposts-headline"><em>Related</em></h3>
</div>			</div><!-- .entry-content -->

	<footer class="entry-footer">
		<p class="entry-byline">By Trail of Bits</p>
		<p class="cat-links">Posted in <a href="https://blog.trailofbits.com/category/uncategorized/" rel="category tag">Uncategorized</a></p>
			</footer>
</article><!-- #post-104838 -->
						<nav role="navigation" id="nav-below" class="site-navigation post-navigation">
			<h1 class="assistive-text">Post navigation</h1>

		
			<div class="nav-previous"><a href="https://blog.trailofbits.com/2023/08/02/a-mistake-in-the-bulletproofs-paper-could-have-led-to-the-theft-of-millions-of-dollars/" rel="prev"><span class="meta-nav">&larr;</span> A mistake in the bulletproofs paper could have led to the theft of millions of dollars</a></div>			
		
		</nav><!-- #nav-below -->
		
					<div id="comments" class="comments-area">
	
	
	
	
	
		<div id="respond" class="comment-respond">
			<h3 id="reply-title" class="comment-reply-title">Leave a Reply<small><a rel="nofollow" id="cancel-comment-reply-link" href="/2023/08/09/use-our-suite-of-ebpf-libraries/#respond" style="display:none;">Cancel reply</a></small></h3>			<form id="commentform" class="comment-form">
				<iframe
					title="Comment Form"
					src="https://jetpack.wordpress.com/jetpack-comment/?blogid=3681601&#038;postid=104838&#038;comment_registration=0&#038;require_name_email=1&#038;stc_enabled=1&#038;stb_enabled=1&#038;show_avatars=1&#038;avatar_default=identicon&#038;greeting=Leave+a+Reply&#038;jetpack_comments_nonce=abd7202c77&#038;greeting_reply=Leave+a+Reply+to+%25s&#038;color_scheme=light&#038;lang=en_US&#038;jetpack_version=12.5-a.7&#038;show_cookie_consent=10&#038;has_cookie_consent=0&#038;token_key=%3Bnormal%3B&#038;sig=22ace9443d482cc2d0315960530438ab432431e0#parent=https%3A%2F%2Fblog.trailofbits.com%2F2023%2F08%2F09%2Fuse-our-suite-of-ebpf-libraries%2F"
											name="jetpack_remote_comment"
						style="width:100%; height: 430px; border:0;"
										class="jetpack_remote_comment"
					id="jetpack_remote_comment"
					sandbox="allow-same-origin allow-top-navigation allow-scripts allow-forms allow-popups"
				>
									</iframe>
									<!--[if !IE]><!-->
					<script>
						document.addEventListener('DOMContentLoaded', function () {
							var commentForms = document.getElementsByClassName('jetpack_remote_comment');
							for (var i = 0; i < commentForms.length; i++) {
								commentForms[i].allowTransparency = false;
								commentForms[i].scrolling = 'no';
							}
						});
					</script>
					<!--<![endif]-->
							</form>
		</div>

		
		<input type="hidden" name="comment_parent" id="comment_parent" value="" />

		
</div><!-- #comments .comments-area -->

			
			</div><!-- #content -->
		</div><!-- #primary .site-content -->

		<div id="secondary" class="widget-area" role="complementary">
						<aside id="search-4" class="widget widget_search">	<form method="get" id="searchform" action="https://blog.trailofbits.com/" role="search">
		<label for="s" class="assistive-text">Search</label>
		<input type="search" class="field" name="s" id="s" placeholder="Search &hellip;" />
		<input type="submit" class="submit" name="submit" id="searchsubmit" value="Search" />
	</form>
</aside><aside id="text-112416548" class="widget widget_text"><h1 class="widget-title">About Us</h1>			<div class="textwidget"><p>Since 2012, Trail of Bits has helped secure some of the world’s most targeted organizations and products. We combine high-­end security research with a real­ world attacker mentality to reduce risk and fortify code.</p>
<p>Read more at <a href="https://www.trailofbits.com">www.trailofbits.com</a></p>
</div>
		</aside><aside id="rss_links-4" class="widget widget_rss_links"><h1 class="widget-title">Subscribe via RSS</h1><p><a target="_self" href="https://blog.trailofbits.com/feed/" title="Subscribe to posts"><img src="https://blog.trailofbits.com/wp-content/plugins/jetpack/images/rss/red-small.png" alt="RSS feed" />&nbsp;RSS - Posts</a></p>
</aside>
		<aside id="recent-posts-5" class="widget widget_recent_entries">
		<h1 class="widget-title">Recent Posts</h1>
		<ul>
											<li>
					<a href="https://blog.trailofbits.com/2023/08/09/use-our-suite-of-ebpf-libraries/" aria-current="page">Use our suite of eBPF libraries</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2023/08/02/a-mistake-in-the-bulletproofs-paper-could-have-led-to-the-theft-of-millions-of-dollars/">A mistake in the bulletproofs paper could have led to the theft of millions of dollars</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2023/07/31/how-ai-will-affect-cybersecurity-what-we-told-the-cftc/">How AI will affect cybersecurity: What we told the CFTC</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2023/07/28/the-future-of-clang-based-tooling/">The future of Clang-based tooling</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2023/07/26/announcing-the-trail-of-bits-testing-handbook/">Announcing the Trail of Bits Testing Handbook</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2023/07/21/fuzzing-on-chain-contracts-with-echidna/">Fuzzing on-chain contracts with Echidna</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2023/07/18/trail-of-bitss-response-to-ostp-national-priorities-for-ai-rfi/">Trail of Bits’s Response to OSTP National Priorities for AI RFI</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2023/07/14/evaluating-blockchain-security-maturity/">Evaluating blockchain security maturity</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2023/07/12/what-we-told-the-cftc-about-crypto-threats/">What we told the CFTC about blockchain threats</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2023/07/07/differential-fuzz-testing-upgradeable-smart-contracts-with-diffusc/">Differential fuzz testing upgradeable smart contracts with Diffusc</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2023/06/16/trail-of-bitss-response-to-ntia-ai-accountability-rfc/">Trail of Bits’s Response to NTIA AI Accountability RFC</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2023/06/15/finding-bugs-with-mlir-and-vast/">Finding bugs in C code with Multi-Level IR and VAST</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2023/05/23/trusted-publishing-a-new-benchmark-for-packaging-security/">Trusted publishing: a new benchmark for packaging security</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2023/05/16/real-world-crypto-2023-recap/">Real World Crypto 2023 Recap</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2023/05/15/introducing-windows-notification-facilitys-wnf-code-integrity/">Introducing Windows Notification Facility&#8217;s (WNF) Code Integrity</a>
									</li>
					</ul>

		</aside><aside id="text-112416546" class="widget widget_text"><h1 class="widget-title">Yearly Archive</h1>			<div class="textwidget"><ul>
<li><a href="https://blog.trailofbits.com/2023">2023</a></li>
<li><a href="https://blog.trailofbits.com/2022">2022</a></li>
<li><a href="https://blog.trailofbits.com/2021">2021</a></li>
<li><a href="https://blog.trailofbits.com/2020">2020</a></li>
<li><a href="https://blog.trailofbits.com/2019">2019</a></li>
<li><a href="https://blog.trailofbits.com/2018">2018</a></li>
<li><a href="https://blog.trailofbits.com/2017">2017</a></li>
<li><a href="https://blog.trailofbits.com/2016">2016</a></li>
<li><a href="https://blog.trailofbits.com/2015">2015</a></li>
<li><a href="https://blog.trailofbits.com/2014">2014</a></li>
<li><a href="https://blog.trailofbits.com/2013">2013</a></li>
<li><a href="https://blog.trailofbits.com/2012">2012</a></li>
</ul></div>
		</aside><aside id="categories-4" class="widget widget_categories"><h1 class="widget-title">Categories</h1>
			<ul>
					<li class="cat-item cat-item-291"><a href="https://blog.trailofbits.com/category/apple/">Apple</a> (13)
</li>
	<li class="cat-item cat-item-141319"><a href="https://blog.trailofbits.com/category/attacks/">Attacks</a> (11)
</li>
	<li class="cat-item cat-item-685590231"><a href="https://blog.trailofbits.com/category/audits/">Audits</a> (7)
</li>
	<li class="cat-item cat-item-44620"><a href="https://blog.trailofbits.com/category/authentication/">Authentication</a> (5)
</li>
	<li class="cat-item cat-item-502354744"><a href="https://blog.trailofbits.com/category/binary-ninja/">Binary Ninja</a> (14)
</li>
	<li class="cat-item cat-item-64575263"><a href="https://blog.trailofbits.com/category/blockchain/">Blockchain</a> (57)
</li>
	<li class="cat-item cat-item-1364812"><a href="https://blog.trailofbits.com/category/capture-the-flag/">Capture the Flag</a> (11)
</li>
	<li class="cat-item cat-item-685590242"><a href="https://blog.trailofbits.com/category/careers/">Careers</a> (2)
</li>
	<li class="cat-item cat-item-685590226"><a href="https://blog.trailofbits.com/category/codeql/">CodeQL</a> (3)
</li>
	<li class="cat-item cat-item-100030"><a href="https://blog.trailofbits.com/category/compilers/">Compilers</a> (26)
</li>
	<li class="cat-item cat-item-9204"><a href="https://blog.trailofbits.com/category/conferences/">Conferences</a> (29)
</li>
	<li class="cat-item cat-item-182564"><a href="https://blog.trailofbits.com/category/containers/">Containers</a> (2)
</li>
	<li class="cat-item cat-item-25818"><a href="https://blog.trailofbits.com/category/cryptography/">Cryptography</a> (45)
</li>
	<li class="cat-item cat-item-28634997"><a href="https://blog.trailofbits.com/category/crytic/">Crytic</a> (4)
</li>
	<li class="cat-item cat-item-199448218"><a href="https://blog.trailofbits.com/category/cyber-grand-challenge/">Cyber Grand Challenge</a> (7)
</li>
	<li class="cat-item cat-item-55871"><a href="https://blog.trailofbits.com/category/darpa/">DARPA</a> (21)
</li>
	<li class="cat-item cat-item-4181544"><a href="https://blog.trailofbits.com/category/dynamic-analysis/">Dynamic Analysis</a> (12)
</li>
	<li class="cat-item cat-item-685590257"><a href="https://blog.trailofbits.com/category/ecosystem-security/">Ecosystem Security</a> (1)
</li>
	<li class="cat-item cat-item-1342"><a href="https://blog.trailofbits.com/category/education/">Education</a> (16)
</li>
	<li class="cat-item cat-item-551269408"><a href="https://blog.trailofbits.com/category/empire-hacking/">Empire Hacking</a> (7)
</li>
	<li class="cat-item cat-item-1360277"><a href="https://blog.trailofbits.com/category/engineering-practice/">Engineering Practice</a> (15)
</li>
	<li class="cat-item cat-item-924"><a href="https://blog.trailofbits.com/category/events/">Events</a> (7)
</li>
	<li class="cat-item cat-item-14563"><a href="https://blog.trailofbits.com/category/exploits/">Exploits</a> (29)
</li>
	<li class="cat-item cat-item-1643774"><a href="https://blog.trailofbits.com/category/fuzzing/">Fuzzing</a> (33)
</li>
	<li class="cat-item cat-item-2812"><a href="https://blog.trailofbits.com/category/go/">Go</a> (4)
</li>
	<li class="cat-item cat-item-320"><a href="https://blog.trailofbits.com/category/guides/">Guides</a> (12)
</li>
	<li class="cat-item cat-item-25357667"><a href="https://blog.trailofbits.com/category/internship-projects/">Internship Projects</a> (34)
</li>
	<li class="cat-item cat-item-96379492"><a href="https://blog.trailofbits.com/category/iverify/">iVerify</a> (4)
</li>
	<li class="cat-item cat-item-46713213"><a href="https://blog.trailofbits.com/category/kubernetes/">Kubernetes</a> (2)
</li>
	<li class="cat-item cat-item-610"><a href="https://blog.trailofbits.com/category/linux/">Linux</a> (2)
</li>
	<li class="cat-item cat-item-685590236"><a href="https://blog.trailofbits.com/category/machine-learning/">Machine Learning</a> (11)
</li>
	<li class="cat-item cat-item-15593"><a href="https://blog.trailofbits.com/category/malware/">Malware</a> (7)
</li>
	<li class="cat-item cat-item-1056516"><a href="https://blog.trailofbits.com/category/manticore/">Manticore</a> (17)
</li>
	<li class="cat-item cat-item-245013018"><a href="https://blog.trailofbits.com/category/mcsema/">McSema</a> (11)
</li>
	<li class="cat-item cat-item-171"><a href="https://blog.trailofbits.com/category/meta/">Meta</a> (12)
</li>
	<li class="cat-item cat-item-6701995"><a href="https://blog.trailofbits.com/category/mitigations/">Mitigations</a> (10)
</li>
	<li class="cat-item cat-item-293462444"><a href="https://blog.trailofbits.com/category/osquery/">osquery</a> (22)
</li>
	<li class="cat-item cat-item-208532"><a href="https://blog.trailofbits.com/category/paper-review/">Paper Review</a> (11)
</li>
	<li class="cat-item cat-item-685590244"><a href="https://blog.trailofbits.com/category/people/">People</a> (6)
</li>
	<li class="cat-item cat-item-685590238"><a href="https://blog.trailofbits.com/category/podcast/">Podcast</a> (1)
</li>
	<li class="cat-item cat-item-685590258"><a href="https://blog.trailofbits.com/category/policy/">Policy</a> (8)
</li>
	<li class="cat-item cat-item-6672"><a href="https://blog.trailofbits.com/category/press-release/">Press Release</a> (28)
</li>
	<li class="cat-item cat-item-3279"><a href="https://blog.trailofbits.com/category/privacy/">Privacy</a> (9)
</li>
	<li class="cat-item cat-item-1589"><a href="https://blog.trailofbits.com/category/products/">Products</a> (7)
</li>
	<li class="cat-item cat-item-5030448"><a href="https://blog.trailofbits.com/category/program-analysis/">Program Analysis</a> (17)
</li>
	<li class="cat-item cat-item-685590239"><a href="https://blog.trailofbits.com/category/recruitment/">Recruitment</a> (1)
</li>
	<li class="cat-item cat-item-685590241"><a href="https://blog.trailofbits.com/category/remote-work/">Remote Work</a> (1)
</li>
	<li class="cat-item cat-item-113884"><a href="https://blog.trailofbits.com/category/research-practice/">Research Practice</a> (22)
</li>
	<li class="cat-item cat-item-299073"><a href="https://blog.trailofbits.com/category/reversing/">Reversing</a> (15)
</li>
	<li class="cat-item cat-item-185574"><a href="https://blog.trailofbits.com/category/rust/">Rust</a> (4)
</li>
	<li class="cat-item cat-item-685590219"><a href="https://blog.trailofbits.com/category/safedocs/">SafeDocs</a> (1)
</li>
	<li class="cat-item cat-item-685590218"><a href="https://blog.trailofbits.com/category/sinter/">Sinter</a> (1)
</li>
	<li class="cat-item cat-item-685590237"><a href="https://blog.trailofbits.com/category/slither/">Slither</a> (3)
</li>
	<li class="cat-item cat-item-401665"><a href="https://blog.trailofbits.com/category/sponsorships/">Sponsorships</a> (12)
</li>
	<li class="cat-item cat-item-538062"><a href="https://blog.trailofbits.com/category/static-analysis/">Static Analysis</a> (28)
</li>
	<li class="cat-item cat-item-19674948"><a href="https://blog.trailofbits.com/category/symbolic-execution/">Symbolic Execution</a> (18)
</li>
	<li class="cat-item cat-item-943"><a href="https://blog.trailofbits.com/category/training/">Training</a> (2)
</li>
	<li class="cat-item cat-item-1"><a href="https://blog.trailofbits.com/category/uncategorized/">Uncategorized</a> (30)
</li>
	<li class="cat-item cat-item-685590256"><a href="https://blog.trailofbits.com/category/windows/">Windows</a> (1)
</li>
	<li class="cat-item cat-item-685590240"><a href="https://blog.trailofbits.com/category/working-at-trail-of-bits/">Working at Trail of Bits</a> (2)
</li>
	<li class="cat-item cat-item-29911"><a href="https://blog.trailofbits.com/category/year-in-review/">Year in Review</a> (5)
</li>
	<li class="cat-item cat-item-685590235"><a href="https://blog.trailofbits.com/category/zero-knowledge/">Zero Knowledge</a> (10)
</li>
			</ul>

			</aside><aside id="twitter_timeline-3" class="widget widget_twitter_timeline"><a class="twitter-timeline" data-height="400" data-theme="light" data-border-color="#e8e8e8" data-tweet-limit="8" data-lang="EN" data-partner="jetpack" data-chrome="nofooter transparent" href="https://twitter.com/trailofbits" href="https://twitter.com/trailofbits">My Tweets</a></aside>		</div><!-- #secondary .widget-area -->

	</div><!-- #main -->

	<footer id="colophon" class="site-footer" role="contentinfo">
		<div class="site-info">
						
			
					</div><!-- .site-info -->
	</footer><!-- .site-footer .site-footer -->
</div><!-- #page .hfeed .site -->

<!--  -->
<style>
			.sd-social-icon .sd-content ul li a.sd-button>span {
				margin-left: 0;
			}
		</style><script defer id="bilmur" data-provider="wordpress.com" data-service="atomic"  src="https://s0.wp.com/wp-content/js/bilmur.min.js?m=202332"></script>

	<script type="text/javascript">
		window.WPCOM_sharing_counts = {"https:\/\/blog.trailofbits.com\/2023\/08\/09\/use-our-suite-of-ebpf-libraries\/":104838};
	</script>
				<script id='coblocks-tinyswiper-initializer-js-extra'>
var coblocksTinyswiper = {"carouselPrevButtonAriaLabel":"Previous","carouselNextButtonAriaLabel":"Next","sliderImageAriaLabel":"Image"};
</script>
<script type='text/javascript'  src='https://blog.trailofbits.com/_static/??-eJyVjksOwjAMRC9ECAg1YoM4CjJOVLlN7KhxieD0fKLCgg2sRvb4jadmg8IaWG2Oc09c7BA0A46Lni6BvUwWZpUEqoSLYyhBHwx6tp6K2ve4HsqqfgejnKPgWNr18FkY4AerJD+TrVOxSnw1pVIO099Pn2xDDTEpQaTbK+aYDlu333Wu2zh3BxwtbbY='></script>
<script id='leadin-script-loader-js-js-extra'>
var leadin_wordpress = {"userRole":"visitor","pageType":"post","leadinPluginVersion":"10.1.30"};
</script>
<script src='https://js.hs-scripts.com/22554992.js?integration=WordPress&#038;ver=10.1.30' async defer id='hs-script-loader'></script>
<script id='jetpack-lazy-images-js-extra'>
var jetpackLazyImagesL10n = {"loading_warning":"Images are still loading. Please cancel your print and try again."};
</script>
<script type='text/javascript'  src='https://blog.trailofbits.com/_static/??-eJytUEtuQjEMvFCDBa2e2gXiKCgkFhhsJyQOT6+nxxIgdcmiK0uej8cz15CKGqqBnVCwA96wLTkucO7QJTIHQR2rc/+YayBNPLKzHExFHLHQsPKyEtIn5+VXeRxJnYpWY7rA3sVwGMQZbCYzbMFIkEnxDfVz7m+ouTSIw4pEM0ovJHD8XQJJPHq8TN2A3Kl1TEZFQzl0bP7a/5/5s3i/AaaL668DB56iZvZgjw52sl1P31/r6WfzOd0Babmdxg=='></script>
<script defer src='https://stats.wp.com/e-202332.js' id='jetpack-stats-js'></script>
<script id="jetpack-stats-js-after" type="text/javascript">
_stq = window._stq || [];
_stq.push([ "view", {v:'ext',blog:'3681601',post:'104838',tz:'-4',srv:'blog.trailofbits.com',hp:'atomic',ac:'2',amp:'0',j:'1:12.5-a.7'} ]);
_stq.push([ "clickTrackerInit", "3681601", "104838" ]);
</script>
<script id='media-video-jwt-bridge-js-extra'>
var videopressAjax = {"ajaxUrl":"https:\/\/blog.trailofbits.com\/wp-admin\/admin-ajax.php","bridgeUrl":"https:\/\/blog.trailofbits.com\/wp-content\/plugins\/jetpack\/jetpack_vendor\/automattic\/jetpack-videopress\/src\/..\/build\/lib\/token-bridge.js","post_id":"104838"};
var videopressAjax = {"ajaxUrl":"https:\/\/blog.trailofbits.com\/wp-admin\/admin-ajax.php","bridgeUrl":"https:\/\/blog.trailofbits.com\/wp-content\/plugins\/jetpack\/jetpack_vendor\/automattic\/jetpack-videopress\/src\/..\/build\/lib\/token-bridge.js","post_id":"104838"};
var videopressAjax = {"ajaxUrl":"https:\/\/blog.trailofbits.com\/wp-admin\/admin-ajax.php","bridgeUrl":"https:\/\/blog.trailofbits.com\/wp-content\/plugins\/jetpack\/jetpack_vendor\/automattic\/jetpack-videopress\/src\/..\/build\/lib\/token-bridge.js","post_id":"104838"};
</script>
<script src='https://blog.trailofbits.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-videopress/src/../build/lib/token-bridge.js?ver=0.14.13' id='media-video-jwt-bridge-js'></script>
<script defer type='text/javascript'  src='https://blog.trailofbits.com/wp-content/plugins/akismet/_inc/akismet-frontend.js?m=1666634240'></script>
<script id='sharing-js-js-extra'>
var sharing_js_options = {"lang":"en","counts":"1","is_stats_active":"1"};
</script>
<script src='https://blog.trailofbits.com/wp-content/plugins/jetpack/_inc/build/sharedaddy/sharing.min.js?ver=12.5-a.7' id='sharing-js-js'></script>
<script id="sharing-js-js-after" type="text/javascript">
var windowOpen;
			( function () {
				function matches( el, sel ) {
					return !! (
						el.matches && el.matches( sel ) ||
						el.msMatchesSelector && el.msMatchesSelector( sel )
					);
				}

				document.body.addEventListener( 'click', function ( event ) {
					if ( ! event.target ) {
						return;
					}

					var el;
					if ( matches( event.target, 'a.share-twitter' ) ) {
						el = event.target;
					} else if ( event.target.parentNode && matches( event.target.parentNode, 'a.share-twitter' ) ) {
						el = event.target.parentNode;
					}

					if ( el ) {
						event.preventDefault();

						// If there's another sharing window open, close it.
						if ( typeof windowOpen !== 'undefined' ) {
							windowOpen.close();
						}
						windowOpen = window.open( el.getAttribute( 'href' ), 'wpcomtwitter', 'menubar=1,resizable=1,width=600,height=350' );
						return false;
					}
				} );
			} )();
var windowOpen;
			( function () {
				function matches( el, sel ) {
					return !! (
						el.matches && el.matches( sel ) ||
						el.msMatchesSelector && el.msMatchesSelector( sel )
					);
				}

				document.body.addEventListener( 'click', function ( event ) {
					if ( ! event.target ) {
						return;
					}

					var el;
					if ( matches( event.target, 'a.share-linkedin' ) ) {
						el = event.target;
					} else if ( event.target.parentNode && matches( event.target.parentNode, 'a.share-linkedin' ) ) {
						el = event.target.parentNode;
					}

					if ( el ) {
						event.preventDefault();

						// If there's another sharing window open, close it.
						if ( typeof windowOpen !== 'undefined' ) {
							windowOpen.close();
						}
						windowOpen = window.open( el.getAttribute( 'href' ), 'wpcomlinkedin', 'menubar=1,resizable=1,width=580,height=450' );
						return false;
					}
				} );
			} )();
var windowOpen;
			( function () {
				function matches( el, sel ) {
					return !! (
						el.matches && el.matches( sel ) ||
						el.msMatchesSelector && el.msMatchesSelector( sel )
					);
				}

				document.body.addEventListener( 'click', function ( event ) {
					if ( ! event.target ) {
						return;
					}

					var el;
					if ( matches( event.target, 'a.share-telegram' ) ) {
						el = event.target;
					} else if ( event.target.parentNode && matches( event.target.parentNode, 'a.share-telegram' ) ) {
						el = event.target.parentNode;
					}

					if ( el ) {
						event.preventDefault();

						// If there's another sharing window open, close it.
						if ( typeof windowOpen !== 'undefined' ) {
							windowOpen.close();
						}
						windowOpen = window.open( el.getAttribute( 'href' ), 'wpcomtelegram', 'menubar=1,resizable=1,width=450,height=450' );
						return false;
					}
				} );
			} )();
var windowOpen;
			( function () {
				function matches( el, sel ) {
					return !! (
						el.matches && el.matches( sel ) ||
						el.msMatchesSelector && el.msMatchesSelector( sel )
					);
				}

				document.body.addEventListener( 'click', function ( event ) {
					if ( ! event.target ) {
						return;
					}

					var el;
					if ( matches( event.target, 'a.share-facebook' ) ) {
						el = event.target;
					} else if ( event.target.parentNode && matches( event.target.parentNode, 'a.share-facebook' ) ) {
						el = event.target.parentNode;
					}

					if ( el ) {
						event.preventDefault();

						// If there's another sharing window open, close it.
						if ( typeof windowOpen !== 'undefined' ) {
							windowOpen.close();
						}
						windowOpen = window.open( el.getAttribute( 'href' ), 'wpcomfacebook', 'menubar=1,resizable=1,width=600,height=400' );
						return false;
					}
				} );
			} )();
var windowOpen;
			( function () {
				function matches( el, sel ) {
					return !! (
						el.matches && el.matches( sel ) ||
						el.msMatchesSelector && el.msMatchesSelector( sel )
					);
				}

				document.body.addEventListener( 'click', function ( event ) {
					if ( ! event.target ) {
						return;
					}

					var el;
					if ( matches( event.target, 'a.share-pocket' ) ) {
						el = event.target;
					} else if ( event.target.parentNode && matches( event.target.parentNode, 'a.share-pocket' ) ) {
						el = event.target.parentNode;
					}

					if ( el ) {
						event.preventDefault();

						// If there's another sharing window open, close it.
						if ( typeof windowOpen !== 'undefined' ) {
							windowOpen.close();
						}
						windowOpen = window.open( el.getAttribute( 'href' ), 'wpcompocket', 'menubar=1,resizable=1,width=450,height=450' );
						return false;
					}
				} );
			} )();
</script>
	<iframe src='https://widgets.wp.com/likes/master.html?ver=202332#ver=202332' scrolling='no' id='likes-master' name='likes-master' style='display:none;'></iframe>
	<div id='likes-other-gravatars'><div class="likes-text"><span>%d</span> bloggers like this:</div><ul class="wpl-avatars sd-like-gravatars"></ul></div>
	
		<!--[if IE]>
		<script type="text/javascript">
			if ( 0 === window.location.hash.indexOf( '#comment-' ) ) {
				// window.location.reload() doesn't respect the Hash in IE
				window.location.hash = window.location.hash;
			}
		</script>
		<![endif]-->
		<script type="text/javascript">
			(function () {
				var comm_par_el = document.getElementById( 'comment_parent' ),
					comm_par = ( comm_par_el && comm_par_el.value ) ? comm_par_el.value : '',
					frame = document.getElementById( 'jetpack_remote_comment' ),
					tellFrameNewParent;

				tellFrameNewParent = function () {
					if ( comm_par ) {
						frame.src = "https://jetpack.wordpress.com/jetpack-comment/?blogid=3681601&postid=104838&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=identicon&greeting=Leave+a+Reply&jetpack_comments_nonce=abd7202c77&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=12.5-a.7&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=22ace9443d482cc2d0315960530438ab432431e0#parent=https%3A%2F%2Fblog.trailofbits.com%2F2023%2F08%2F09%2Fuse-our-suite-of-ebpf-libraries%2F" + '&replytocom=' + parseInt( comm_par, 10 ).toString();
					} else {
						frame.src = "https://jetpack.wordpress.com/jetpack-comment/?blogid=3681601&postid=104838&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=identicon&greeting=Leave+a+Reply&jetpack_comments_nonce=abd7202c77&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=12.5-a.7&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=22ace9443d482cc2d0315960530438ab432431e0#parent=https%3A%2F%2Fblog.trailofbits.com%2F2023%2F08%2F09%2Fuse-our-suite-of-ebpf-libraries%2F";
					}
				};

				
				if ( 'undefined' !== typeof addComment ) {
					addComment._Jetpack_moveForm = addComment.moveForm;

					addComment.moveForm = function ( commId, parentId, respondId, postId ) {
						var returnValue = addComment._Jetpack_moveForm( commId, parentId, respondId, postId ),
							cancelClick, cancel;

						if ( false === returnValue ) {
							cancel = document.getElementById( 'cancel-comment-reply-link' );
							cancelClick = cancel.onclick;
							cancel.onclick = function () {
								var cancelReturn = cancelClick.call( this );
								if ( false !== cancelReturn ) {
									return cancelReturn;
								}

								if ( ! comm_par ) {
									return cancelReturn;
								}

								comm_par = 0;

								tellFrameNewParent();

								return cancelReturn;
							};
						}

						if ( comm_par == parentId ) {
							return returnValue;
						}

						comm_par = parentId;

						tellFrameNewParent();

						return returnValue;
					};
				}

				
				// Do the post message bit after the dom has loaded.
				document.addEventListener( 'DOMContentLoaded', function () {
					var iframe_url = "https:\/\/jetpack.wordpress.com";
					if ( window.postMessage ) {
						if ( document.addEventListener ) {
							window.addEventListener( 'message', function ( event ) {
								var origin = event.origin.replace( /^http:\/\//i, 'https://' );
								if ( iframe_url.replace( /^http:\/\//i, 'https://' ) !== origin ) {
									return;
								}
								frame.style.height = event.data + 'px';
							});
						} else if ( document.attachEvent ) {
							window.attachEvent( 'message', function ( event ) {
								var origin = event.origin.replace( /^http:\/\//i, 'https://' );
								if ( iframe_url.replace( /^http:\/\//i, 'https://' ) !== origin ) {
									return;
								}
								frame.style.height = event.data + 'px';
							});
						}
					}
				})

			})();
		</script>

		
</body>
</html>
<!--
	generated 160 seconds ago
	generated in 0.183 seconds
	served from batcache in 0.002 seconds
	expires in 140 seconds
-->
